Effects
Conficker.C is designed to spread by exploiting a vulnerability in the Windows Server Service which allows remote code execution. Conficker.C is designed to spread by exploiting a vulnerability in the Windows Server service which allows remote code execution. It is the vulnerability MS08-067 . It is the vulnerability MS08-067.

Additionally, if the system date is after December 1, 2008, it will attempt to download and run another type of malware from the following website: Additionally, if the system date is after December 1, 2008, it will attempt to download and run another type of malware from the following website:
http://traff <blocked> verter.biz http://traff <blocked> verter.biz

The malware it attempts to download might be a fake antimalware program. The malware attempts to download it might be a fake antimalware program.

Infection strategy Infection strategy
Conficker.C creates a copy of itself in the folder RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665 of all the available drives of the computer. Conficker.C creates a copy of itself in the folder Recycled \ S-5-3-42-2819952290-8240758988-879315005-3665 of all the available drives of the computer. It is copied under the name JWGKVSQ.VMX . It is copied under the name JWGKVSQ.VMX. The folder S-5-3-42-2819952290-8240758988-879315005-3665 is created by the worm. The folder S-5-3-42-2819952290-8240758988-879315005-3665 is created by the worm.

Additionally, it creates an AUTORUN.INF file in all the drives. Additionally, it creates an AUTORUN.INF file in all the drives. This way, it is run whenever any of them is accessed. This way, it is run whenever any of them is accessed.

On the other hand, it creates a scheduled task in the folder Tasks of the Windows directory in order to start its execution periodically. On the other hand, it creates a scheduled task in the Tasks folder of the Windows directory in order to start its execution periodically.


Conficker.C creates the following entries in the Windows Registry : Conficker.C creates the following entries in the Windows Registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run
jwgkvsq = rundll32.exe RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx, ahaezedrn jwgkvsq = rundll32.exe recycled \ S-5-3-42-2819952290-8240758988-879315005-3665 \ jwgkvsq.vmx, ahaezedrn
By creating this entry, Conficker.C ensures that it is run whenever Windows is started. By creating this entry, Conficker.C ensures that it is run whenever Windows is started.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \
Services\netsvcs Services \ netsvcs
Image Path = %sysdir%\svchost.exe -k netsvcs Image Path =% SYSDIR% \ svchost.exe-k netsvcs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \
Services\netsvcs\Parameters Services \ netsvcs \ Parameters
ServiceDll = C:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\ jwgkvsq.vmx ServiceDll = C: \ recycled \ S-5-3-42-2819952290-8240758988-879315005-3665 \ jwgkvsq.vmx
By creating these entries, it registers itself as a service. By creating these entries, it registers itself as a service.

Conficker.C modifies the following entries from the Windows Registry in order to make its detection more difficult: Conficker.C modifies the following entries from the Windows Registry in order to make its detection more difficult:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced
SuperHidden = 1 SuperHidden = 1
It changes this entry to: It changes this entry to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced
SuperHidden = 0 SuperHidden = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced
Hidden = 1 Hidden = 1
It changes this entry to: It changes this entry to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced
Hidden = 0 Hidden = 0
It hides the files and folders with hidden attribute. It hides the files and folders with hidden attribute.
Means of transmission Means of transmission
Conficker.C spreads by exploiting the vulnerability called MS08-067 , which is a vulnerability in the Windows server service. Conficker.C spreads by exploiting the vulnerability called MS08-067, which is a vulnerability in the Windows server service. In order to do so, it sends malformed RPC requests to other computers. In order to do so, it sends malformed RPC requests to other computers. If any of them is vulnerable, it will download a copy of the worm to the system. If any of them is vulnerable, it will download a copy of the worm to the system.

Additionally, Conficker.C also spreads through the system drives, both shared and removable, making copies of itself in them. Additionally, Conficker.C also spreads through the system drives, both shared and removable, making copies of itself in them. It also creates an AUTORUN.INF file in order to be run whenever any of them is accessed. It also creates an AUTORUN.INF file in order to be run whenever any of them is accessed.